Identify and fix the virus signature match

[sjackson0109]

Version

latest

OS

n/a

What is wrong?

Nobody will use this tool if windows immediately advises a virus exists.

Chrome and Firefox both block the download of the exe from the latest release. And if i use curl to bring it down, windows blocks it with defender.

You might want to put some time into finding the root cause and fixing that.

What did you try already?

n/a

How to reproduce the bug?

download from github releases section

What is the behavior that you expected?

expect the file not be trigger an antivirus payload alert from modern av scanning software.

Logs

none provided

Additional information

No response

[sergiye]

cmon man, just read app description

if someone gives me money or buys me a digital signature certificate, the problem will be solved.
but for now everyone is happy with the way things are

[sjackson0109]

Hi @sergiye,

I saw the note about bypassing security controls. my cyber security background strongly advise against that approach, particularly for users in managed or enterprise environments; it would not be allowed.
Personally, I would never follow an instruction like this, and neither would 80%+ of people that I know in the world IT.
Don't take that as criticism, i'm reporting this to try and help, as i believe in this project.

Can you confirm whether this binary has been submitted to Microsoft Defender Security Intelligence portal for false positive review?
It is currently being flagged by Microsoft Defender Antivirus on a clean system. Submitting it would allow Microsoft to validate the file and, if confirmed as safe, update their detection logic accordingly.
If this has not yet been done, I recommend submitting the binary and its hash to expedite reclassification.

Separately, code signing would materially improve trust and reduce the likelihood of repeated detections. If cost is a concern, options such as SignPath Foundation may be worth considering.

Happy to provide the detection details or assist with submission if useful.

Simon Jackson

[sergiye]

for users in managed or enterprise environments; it would not be allowed

I think they are capable of buying a license for an RDP server from Microsoft.
The idea behind the program was to automate the setup process for private use.
I spent time on it because I personally needed it, but I won't spend money on a signing certificate so corporations can use it and save their money

[sjackson0109]

Like I said you can get signing signatures for free.

[phoenX80]

I checked the file via Kaspersky and Kasperysky was fine with it. Not sure wether MS would excatly pass this exe .... Do you mean to submit here: https://www.microsoft.com/en-us/wdsi/filesubmission ?

[sjackson0109]

I downloaded your repo, and compiled this exe and my version is a different file size, an is not automatically quarantined. This tells me your variant has other changes in; perhaps you have a .gitignore file excluding certain components?

I shall leave you to identify why yours is getting blocked.

That URL looks correct.

[phoenX80]

I am a noob, but I compiled something for the first time. Did you compare the exact same versions? When I compile the version number is newer than the git version and it apparently creates a combined x86/x64 version, not either version. Maybe Defender has the compiled version already flagged (submitted) while your newer compiled version is not caught yet? But I am no dev, just a user. I can't post a pic here it seems.

[sergiye]

So many questions... okay, let's try to find answers to them!

options such as SignPath Foundation may be worth considering

Yes, I sent them a completed form requesting a certificate, but still no response.

Can you confirm whether this binary has been submitted to Microsoft Defender Security Intelligence portal for false positive review?

yes, same result

Happy to provide the detection details or assist with submission if useful.

This would be great, especially since different versions of Windows can use different versions of Defender and they can have different Detection names and Definition versions.

I'd also like to point out that you're asking me, "Why does Microsoft detect a program as dangerous?" Why should I explain Microsoft's reasons for their decision? Ask Microsoft this question, send them the file as "Incorrectly detected as malware/malicious," and maybe then we'll find out the reason (or not).
We have 6 versions of the application build and a dozen different versions of the operating system on which they run - the number of combinations is large enough that only one person can handle all these reports.

I checked the file via Kaspersky and Kasperysky was fine with it. Not sure wether MS would excatly pass this exe .... Do you mean to submit here: https://www.microsoft.com/en-us/wdsi/filesubmission ?

yes, submit it as HomeUser, let them explain their decision

compiled this exe and my version is a different file size

yes, my build is optimized and does not contain parts of the code from the shared libraries that are not used in the program, due to this, my version will be smaller in size than yours (especially if you do not count the additional 6 KB for a homemade digital signature to pass tests in VirusTotal)

You also probably remember that the contents of almost any ready-made dotnet assembly can be studied and compared, for example, using utilities such as ILSPY or DotPeek.
DotPeek, for example, allows you to compare the differences in code between my and your builds.
https://www.jetbrains.com/help/decompiler/Compare_Assemblies.html (Don't take this as their advertisement)
Feel free to compare and please confirm if you have time to do so.

I downloaded your repo, and compiled this exe and my version is a different file size, an is not automatically quarantined

and

Maybe Defender has the compiled version already flagged (submitted) while your newer compiled version is not caught yet?

Defender will not block code compiled on your computer (in most cases).

Please, if you can find the answer on Google or Chatgpt, don't ask questions here. I don't always have free time, and due to the daily russian shelling, there are frequent power and internet outages.

[sjackson0109]

Hope you are generally safe @sergiye Message me on discord, same id. Will gladly offer support

…

On 31 Mar 2026, at 16:07, Sergiy Egoshyn ***@***.***> wrote: sergiye

[sergiye]

Thanks for the offer, I just wanted to explain why I don't have extra time to troubleshoot Windows Defender issues and why I might not be able to answer questions here right away.
And as for support, the EU is already helping us, thank you! :)